Microsoft’s Home State’s Facial Recognition Privacy Bill Could Be Model for Others

Two months after calling for laws to regulate facial-recognition software, Microsoft Corp. is lobbying on behalf of a first-of-its-kind bill in its home state of Washington. The question is whether cross-town rival Amazon.com Inc. will support it.

Amazon has asked the bill’s sponsor, State Senator Reuven Carlyle, for some clarifications and changes around areas like a requirement that makers of AI software claiming to identify faces open up their product to third-parties who want to test it, Carlyle said. Carlyle has reviewed requests for re-wording and changes to the bill from various parties, including Amazon, and on Thursday is submitting a revised version of his proposal.

“It’s fair to say Amazon has a deep skepticism and concern about meaningful restrictions on facial recognition. It’s clearly a core technology to their long-term business strategy,” said Carlyle, a Democrat who represents parts of Seattle, including Amazon’s headquarters. The company wants to preserve its ability to innovate, he said. Still, “they have made it clear their goal is to attempt to get to a place where they can be supportive of the legislation.” Artificial intelligence software is becoming an increasingly important business to some of the biggest tech companies in the U.S. and China. Some of the companies as well as advocacy groups are concerned the technology, particularly the products that track and categorize people by their facial characteristics, are biased and may compromise privacy. Amazon in particular has argued with some researchers critical of its software. Now governments are taking the first steps toward regulation.

Opening up the software for third-party testing is one of the key parts of the bill, Microsoft President and Chief Legal Officer Brad Smith said in an interview. Any company that makes this kind of software should back it, he said.

Opposing testing is “like an automobile company objecting to testing of airbags,” Smith said. “Why should a company object to the public having the ability to know whether its services work well? The public has the right to evaluate these services, and responsible companies should recognize the importance of this kind of third-party testing.”

Amazon declined to comment on whether it will back legislation because it’s still being modified. The company issued a blog post Thursday with its ideas about how facial-recognition software should be governed. For example, the company said when law enforcement agencies use the software, people in those agencies need to review the results to make sure civil liberties aren’t violated. Amazon also said it supports standardized testing of facial recognition software.

“It’s critical that any legislation protect civil rights while also allowing for continued innovation and practical application of the technology,” wrote Michael Punke, vice president of global public policy at Amazon Web Services.

Conspicuous Notice

The bill also would require several other steps that Microsoft’s Smith suggested in a December blog, including plain English language explaining what the programs do, conspicuous notification to customers when they are being analyzed by the software and the requirement for meaningful human review in any “final decisions based on such profiling where such final decisions produce legal effects concerning consumers or similarly significant effects concerning consumers.” It also would ban ongoing surveillance using the software without a court order, except in cases of emergency where there is risk to human life or serious injury.

“The public has a right to intentional permission, intentional opt-in. It can’t be on page 73 of a 77-page a fine-print privacy policy that you just click,” Carlyle said. “You have the right to walk through the public square and be unmolested by the government, and I would argue, by companies.”Carlyle plans a meeting early next week to discuss the proposal and has invited companies and advocacy groups. He hopes to move the bill out of committee at the end of next week.

While the legislation, part of a larger privacy bill, is being considered in Washington State, it would affect not just companies based there like Amazon and Microsoft, but any that do business in the state and either process data of 100,000 or more consumers or get half their revenue from the sale of personal data. The legislation may also serve as a model for others, even if it doesn’t pass, Smith said. Amazon and Microsoft have seen their facial-recognition AI programs audited by third parties, including MIT Media Lab researcher Joy Buolamwini and the American Civil Liberties Union.

Presented with a finding that the facial-recognition software performed worse on images of darker faces, particularly women, Microsoft Chief Executive Officer Satya Nadella ordered his researchers and engineers to fix the product. Amazon has argued against the reports, saying researchers didn’t properly test the software or used settings that aren’t precise enough to be the ones the company recommends for critical applications like law enforcement.

“If it passes, it takes an important and much needed step to be a regulatory foundation for facial recognition technology and create a model that can be considered by other states and countries,” Smith said of the Washington bill.